Get a user access token
Client provides authorization token obtained from /api/v3/oauth2/authorize to this endpoint and receives an access token. Access token can then be used to query API endpoints. ### Request Access Token After user approves your access to the given scope form the https:/app.quantimo.do/v1/oauth2/authorize endpoint, you'll receive an authorization code to request an access token. This time make a POST request to /api/v1/oauth/access_token with parameters including: * grant_type Can be authorization_code or refresh_token since we are getting the access_token for the first time we don't have a refresh_token so this must be authorization_code. * code Authorization code you received with the previous request. * redirect_uri Your application's redirect url. ### Refreshing Access Token Access tokens expire at some point, to continue using our api you need to refresh them with refresh_token you received along with the access_token. To do this make a POST request to /api/v1/oauth/access_token with correct parameters, which are: * grant_type This time grant type must be refresh_token since we have it. * clientId Your application's client id. * client_secret Your application's client secret. * refresh_token The refresh token you received with the access_token. Every request you make to this endpoint will give you a new refresh token and make the old one expired. So you can keep getting new access tokens with new refresh tokens. ### Using Access Token Currently we support 2 ways for this, you can't use both at the same time. * Adding access token to the request header as Authorization: Bearer {access_token} * Adding to the url as a query parameter ?access_token={access_token} You can read more about OAuth2 from here
Query parameters
Your CureDAO client id can be obtained by creating an app at https://builder.quantimo.do
This is the secret for your obtained clientId. We use this to ensure that only your application uses the clientId. Obtain this by creating a free application at https://builder.quantimo.do.
Grant Type can be 'authorization_code' or 'refresh_token'
Authorization code you received with the previous request.
If the value is code, launches a Basic flow, requiring a POST to the token endpoint to obtain the tokens. If the value is token id_token or id_token token, launches an Implicit flow, requiring the use of Javascript at the redirect URI to retrieve tokens from the URI #fragment.
Scopes include basic, readmeasurements, and writemeasurements. The basic scope allows you to read user info (displayName, email, etc). The readmeasurements scope allows one to read a user's data. The writemeasurements scope allows you to write user data. Separate multiple scopes by a space.
The redirect URI is the URL within your client application that will receive the OAuth2 credentials.
An opaque string that is round-tripped in the protocol; that is to say, it is returned as a URI parameter in the Basic flow, and in the URI
Response
Successful Operation